Enable Windows Serive II

Little extension of my last post

1)regedit /s
/s execute .reg,
Export that reg on your localmachine and upload to target host
or
echo .reg content in case you can't upload any to target(In fact,this is one of the reasons you need to modify the registry to enable service like telnet, remote desktop etc)

2)regini
This is another great command (esp its detail man page - Win2003 only)
e.g: regini.exe -m \\Server_name -b yourhack.txt

Thx h3llfyr3 for reminding me!

3)reg.exe
A command line version of registry editor, native process of WinXP and Win2003(Win2k Resource Kit),a very powerful tool.
Details can be found atpetri.co.il

Brief examples:
reg query {\\server_name\}HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr

Drawback:
1) WinXP and 2003 only
2) Require to be fairly familiar with registry structure and need to remember its options.
3) Lack of modify key value option (Maybe I don't know)

Other:
VBscript/Jscript Default MS scripting engine
Perl if and only if target system has perl (and Win32 package)installed

IE context menu

Ok,create a IE context menu is not new any all.

Credits to old new things (http://blogs.msdn.com/oldnewthing/archive/2004/05/24/140283.aspx)
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Context_Name
@="c:\\path\file.htm"

Then we can do funky things in html page,you can use common scripting language like javascript, vbscript to manipulate functions.

< script language="Javascript">
var fac = prompt("Factor",100);
external.menuArguments.document.body.style.zoom=fac+"%";
< /script>

As you see external is the object,with menuArguments method to do zooming.An alternative method is make a external object, port it as dll file or use your binary to output a html....Your design!

End? No yet, from a user's point of view, there might be some anonying malware injected into his/her IE, think about how to contrust a context menu?There you go, go to registry and delete the keys, also keep an eye on what lib it relies on(usually locates at HKCR\{id}), delete its lib as well. In fact, this is how some popluar anti-malware works (e.g:spybot), if you are designing similar software, it is worthwhile to dig into registry, the core of windows.

p.s: An interesting method by willij3 presents a shorter and neat hack
http://www.rpi.edu/~willij3/hacks/IEContextMenu_Reg.txt

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\&Dictionary.com]
@="javascript: open('http://www.dictionary.com/cgi-bin/dict.pl?term=' + external.menuArguments.document.selection.createRange().text,\"dictionary\");"
"Contexts"=dword:00000010

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\&Google]
@="javascript: open('http://www.google.com/search?q=' + external.menuArguments.document.selection.createRange().text,\"google\");"
"Contexts"=dword:00000010

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\&Open In New Window]
@="javascript: open(external.menuArguments.document.selection.createRange().text);"
"Contexts"=dword:00000010

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\&Search Slashdot]
@="javascript: open('http://slashdot.org/search.pl?query=' + external.menuArguments.document.selection.createRange().text,\"/.\");"
"Contexts"=dword:00000010

Windows Command Line

Do you know Windows Management Instrumentation Command-line (WMIC) tool?

Nope, then you should peer at wmic man page by
wmic/?

Sample command usage
wmic bios > os-bios.xls
wmic process > os-process.xls
wmic os > os.xls

This comes faily handy, but three drawbacks I have found so far are
1) You have to admin (Isn't MS advocating least-privilege law)
2) It only supports Windows XP Pro and 2003
3) Lack of output indentation

Anyway, it is a pretty cool utility, all windows power user should spend little bit time on learning it.

More WMIC info can be found here